Law 18-07: A Practical Data-Protection Checklist for Algerian Companies

The framework to use in August 2026

Read Law 18-07 together with its amendments, applicable implementing texts, ANPDP procedures, and sector duties. Separate legal requirements from Atlas implementation recommendations.

1. Inventory processing, not only databases

• Name the purpose and business owner.
• List people and data categories.
• Record sources, recipients, processors, and transfers.
• Define retention and deletion.
• Link systems, access, and security measures.

2. Make individual rights executable

Provide an intake route, verify identity proportionately, locate data across systems, record decisions, and test access, correction, objection, and deletion workflows end to end.

3. Link security to processing risk

Classify data and exposure, minimise access, log sensitive actions, protect transfers and backups, test restoration, and document residual risk rather than applying a generic checklist.

4. Govern processors, transfers, and SaaS

Verify purpose, instructions, security, subcontracting, incident duties, location, deletion, audit evidence, and exit before granting access to personal data.

5. Prepare for a data breach

Define detection, containment, evidence, legal assessment, communication, notification decisions, remediation, and ownership before an incident occurs.

Composite example: a sales form that became a permanent database

A short campaign form can become uncontrolled processing when data is copied into CRM, spreadsheets, messaging tools, and exports with no retention owner. Map the full flow, not the original form alone.